Jami Cogswell
|
bd47dcc87d
|
Java: check first arg for taint
|
2025-02-05 16:56:16 -05:00 |
|
Jami Cogswell
|
e8724ab220
|
Java: sanitize constructor call instead and update test cases
|
2025-02-05 15:46:10 -05:00 |
|
Kristen Newbury
|
86e51dad8a
|
Improve JCA aes alg model, add test
|
2025-02-05 13:39:48 -05:00 |
|
Jami Cogswell
|
4a4585a526
|
Java: move comment
|
2025-02-05 11:36:58 -05:00 |
|
Jami Cogswell
|
60cc16cc0e
|
Java: change note
|
2025-02-04 17:51:34 -05:00 |
|
Jami Cogswell
|
59d454771d
|
Java: add FileConstructorSanitizer and tests
|
2025-02-04 17:51:23 -05:00 |
|
Kristen Newbury
|
5f355c7f55
|
Add first sample JCA encryption model
|
2025-02-04 11:55:09 -05:00 |
|
github-actions[bot]
|
f1b05a79a4
|
Post-release preparation for codeql-cli-2.20.4
|
2025-02-04 09:25:09 +00:00 |
|
Arthur Baars
|
dd34690c17
|
Merge branch 'codeql-cli-2.20.4' into release-prep/2.20.4
|
2025-02-03 18:37:16 +01:00 |
|
github-actions[bot]
|
573e53e454
|
Release preparation for version 2.20.4
|
2025-02-03 15:19:35 +00:00 |
|
Jonas Jensen
|
0584aee72a
|
Merge pull request #18636 from jbj/diff-informed-java-location-fixups
Java: make diff-informed queries exact
|
2025-02-03 15:22:43 +01:00 |
|
Jonas Jensen
|
7ad6f13bf5
|
Java: adjust CommandLineQuery locations
It turns out these locations need to be precise.
|
2025-01-31 11:37:16 +01:00 |
|
Jami Cogswell
|
530103e2d9
|
Java: narrow query
remove PUT and DELETE from StaplerCsrfUnprotectedMethod
remove OPTIONS and TRACE from SpringCsrfUnprotectedMethod
|
2025-01-30 10:14:31 -05:00 |
|
Jami Cogswell
|
f3721ebccf
|
Java: refactor unprotectedDatabaseUpdate
|
2025-01-30 10:14:26 -05:00 |
|
Jami Cogswell
|
530a77e5a0
|
Java: refactor into canTargetDatabaseUpdateMethod
|
2025-01-30 10:14:24 -05:00 |
|
Jami Cogswell
|
8173fd01b8
|
Java: use two negations
|
2025-01-30 10:14:22 -05:00 |
|
Jami Cogswell
|
0462425191
|
Java: rename getMethod to getMethodValue
|
2025-01-30 10:14:20 -05:00 |
|
Jami Cogswell
|
20e8eb4323
|
Java: some clean-up and refactoring
|
2025-01-30 10:14:18 -05:00 |
|
Jami Cogswell
|
26b7c1a572
|
Java: qldocs for CallGraph module
|
2025-01-30 10:14:09 -05:00 |
|
Jami Cogswell
|
48d55ec518
|
Java: performance fix
|
2025-01-30 10:14:03 -05:00 |
|
Jami Cogswell
|
48d1fe062b
|
Java: remove exists variable
|
2025-01-30 10:13:59 -05:00 |
|
Jami Cogswell
|
39ccde0c9d
|
Java: add name-based heuristic
|
2025-01-30 10:13:54 -05:00 |
|
Jami Cogswell
|
286c655264
|
Java: add class for Stapler web methods that are not default-protected from CSRF
|
2025-01-30 10:13:52 -05:00 |
|
Jami Cogswell
|
0f39011122
|
Java: add taint-tracking config for execute to exclude FPs from non-update queries like select
|
2025-01-30 10:13:50 -05:00 |
|
Jami Cogswell
|
97aaf4c011
|
Java: handle MyBatis annotations for insert/update/delete
|
2025-01-30 10:13:48 -05:00 |
|
Jami Cogswell
|
df77d4914f
|
Java: initial tests
|
2025-01-30 10:13:45 -05:00 |
|
Jami Cogswell
|
c553e3132e
|
Java: add CallGraph module for displaying call graph paths
|
2025-01-30 10:13:41 -05:00 |
|
Jami Cogswell
|
87a8746b22
|
Java: add a class for methods that update a sql database (found using sql-injection nodes)
|
2025-01-30 10:13:39 -05:00 |
|
Jami Cogswell
|
43a288070c
|
Java: add a class for PreparedStatement methods that update a database
|
2025-01-30 10:13:37 -05:00 |
|
Jami Cogswell
|
b88731df80
|
Java: move contents of MyBatisMapperXML.qll in src to MyBatis.qll in lib so importable, and fix experimental files broken by the move
|
2025-01-30 10:13:27 -05:00 |
|
Jami Cogswell
|
8e9f21dc52
|
Java: add a class for MyBatis Mapper methods that update a database
|
2025-01-30 10:01:43 -05:00 |
|
Jami Cogswell
|
506d668289
|
Java: add class for Spring request mapping methods that are not default-protected from CSRF
|
2025-01-30 10:01:41 -05:00 |
|
Michael Nebel
|
ee5416f0b1
|
Merge pull request #18299 from michaelnebel/java/deprecateexperimental
Java: Deprecate experimental queries.
|
2025-01-29 10:41:25 +01:00 |
|
Owen Mansel-Chan
|
0ccf4cecb8
|
Fix XSS FPs when content type is safe
|
2025-01-28 15:32:30 +00:00 |
|
erik-krogh
|
c7fc164680
|
java: remove the 2 from SafeTransformerFactoryFlow, not that the previous naming conflict has been deleted
|
2025-01-28 09:13:59 +01:00 |
|
erik-krogh
|
a1afa20d4b
|
add change-notes
|
2025-01-27 22:43:13 +01:00 |
|
erik-krogh
|
34f5f61a10
|
all: use my script to delete outdated deprecations
|
2025-01-27 22:16:48 +01:00 |
|
Michael Nebel
|
98d6353f12
|
Java: Address review comments.
|
2025-01-27 11:21:44 +01:00 |
|
Michael Nebel
|
cc48cec1c7
|
Java: Deprecate experimental model activation.
|
2025-01-27 10:22:17 +01:00 |
|
Jonas Jensen
|
773a98a9eb
|
Merge pull request #18340 from jbj/diff-informed-getASelectedLocation
Java: make more queries diff-informed with getASelectedLocation
|
2025-01-22 14:25:33 +01:00 |
|
Anders Schack-Mulligen
|
5bfd22e60a
|
Merge pull request #18552 from aschackmull/java/xss-regex-perf
Java: Improve performance of XSS regex.
|
2025-01-22 11:28:49 +01:00 |
|
Owen Mansel-Chan
|
b4c8390991
|
Merge pull request #18137 from owen-mc/java/jax-rs-annotation-inheritance
Java: Update JAX-RS annotation inheritance
|
2025-01-21 15:26:47 +00:00 |
|
Anders Schack-Mulligen
|
0f96e79264
|
Java: Improve performance of XSS regex.
|
2025-01-21 14:41:08 +01:00 |
|
Jonas Jensen
|
eacc600b29
|
Java: annotate a query as not selecting sources
This is for performance in diff-informed mode but also for avoiding
spurious entries in the code scanning timeline and alert list.
|
2025-01-21 12:56:06 +01:00 |
|
Owen Mansel-Chan
|
6fa18be0cc
|
Fix QLDocs
|
2025-01-20 22:07:01 +00:00 |
|
github-actions[bot]
|
fbb7f0a0c6
|
Post-release preparation for codeql-cli-2.20.2
|
2025-01-20 21:11:14 +00:00 |
|
github-actions[bot]
|
a0512a50f2
|
Release preparation for version 2.20.2
|
2025-01-20 21:11:12 +00:00 |
|
Nick Rolfe
|
6b5974a372
|
Java: fix stats for databaseMetadata relation
|
2025-01-20 17:02:25 +00:00 |
|
Nick Rolfe
|
64f33955b5
|
Java: add databaseMetadata to dbscheme
|
2025-01-17 15:18:07 +00:00 |
|
Chris Smowton
|
060161cd5e
|
Add change note
|
2025-01-14 14:22:27 +00:00 |
|